Yorgos Thessalonikefs

Ratelimit countermeasure for STARTTLS in mailtest

7

For the STARTTLS test some mailservers use strict ratelimits on the number and the rate of connections used when testing. The current tests are run in series to avoid the...

Do not reuse timed out IP addresses in the STARTTLS test

9

There is a case that mail administrators advertise IP addresses that always timeout in order to deter spammers. When such an IP is encountered it should be ignored for further...

Interactive mail test

3

Introduce an interactive mail test to thoroughly test SPF, DMARC, DKIM and DANE with actual email communication. The first iteration and testing of the feature is going to be for...

CSP: use PSL for CSP's default-src check

3

The `default-src` directive on CSP needs to be as restrictive as possible because it needs to function as a secure fallback in case something is not defined. Currently we accept...

Check for A/AAAA/MX DNSSEC records

2

This issue is for additionally checking A/AAAA/MX records for DNSSEC if applicable. From an email conversation about checking SOA and A/AAAA/MX DNSSEC records: > The goal of the test is...

This is a rebase from https://github.com/gthess/unbound/tree/proxy_protocol_2_wip for downstream PROXYv2 support. ## Progress: - [x] PROXYv2 support (per port) for plain UDP/TCP - [x] Configuration option (proxy-protocol-port) - [x] Test client...

Redis read-only replica support

3

This PR introduces a Redis replica server next to an Redis server that is assumed to be in read-only mode. If configured, Redis read commands will go there while write...

Draft the idea of unjostable queries if upstreams are explicitly configured. *May* prove useful if Unbound's general upstream connectivity is problematic and request list keeps growing. Then a client query...

Currently breaks software that sends the SOA probe query over UDP.